139 lines
3.8 KiB
YAML
139 lines
3.8 KiB
YAML
id: php-backup-files
|
|
|
|
info:
|
|
name: PHP Source - Backup File Information Disclosure
|
|
author: StreetOfHackerR007,pwnhxl,mastercho,0xpugazh
|
|
severity: medium
|
|
description: PHP Source File is disclosed to external users.
|
|
metadata:
|
|
max-request: 1512
|
|
tags: exposure,backup,php,disclosure,fuzz
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}{{filepath}}{{bakext}}"
|
|
|
|
attack: clusterbomb
|
|
payloads:
|
|
filepath:
|
|
- /wp-config.php # wordpress
|
|
- /wp-config # wordpress
|
|
- /site/default/settings.php # drupal
|
|
- /installation/configuration.php # joomla
|
|
- /app/etc/env.php # magento
|
|
- /Application/Common/Conf/config.php # thinkphp
|
|
- /environments/dev/common/config/main-local.php # yii
|
|
- /environments/prod/common/config/main-local.php # yii
|
|
- /common/config/main-local.php # yii
|
|
- /system/config/default.php # opencart
|
|
- /typo3conf/localconf.php # typo3
|
|
- /config/config_global.php # discuz
|
|
- /config/config_ucenter.php # discuz
|
|
- /textpattern/config.php # textpattern
|
|
- /data/common.inc.php # dedecms
|
|
- /caches/configs/database.php # phpcms
|
|
- /caches/configs/system.php # phpcms
|
|
- /include/config.inc.php # phpcms
|
|
- /include/config.php # xbtit
|
|
- /includes/config.php # vbulletin
|
|
- /includes/config # vbulletin
|
|
- /phpsso_server/caches/configs/database.php # phpcms
|
|
- /phpsso_server/caches/configs/system.php # phpcms
|
|
- /zb_users/c_option.php # zblog
|
|
- /e/class/config.php # empirecms
|
|
- /e/config/config.php # empirecms
|
|
- /data/sql_config.php # phpwind
|
|
- /data/bbscache/config.php # phpwind
|
|
- /app/config/parameters.yml # prestashop 1.7
|
|
- /app/config/parameters.php # prestashop 1.7
|
|
- /config/settings.inc.php # prestashop > 1.5,1.6
|
|
- /config/settings.old.php # prestashop > 1.5,1.6
|
|
- /manager/includes/config.inc.php # MODX CMS
|
|
- /app/config/parameters.ini # Symfony
|
|
- /db.php
|
|
- /conn.php
|
|
- /database.php
|
|
- /db_config.php
|
|
- /config.inc.php
|
|
- /data/config.php
|
|
- /config/config.php
|
|
- /index.php
|
|
- /default.php
|
|
- /main.php
|
|
- /settings.php
|
|
- /header.php
|
|
- /footer.php
|
|
- /login.php
|
|
- /404.php
|
|
- /wp-login.php
|
|
- /config.php
|
|
- /config
|
|
- /const.DB.php.bak
|
|
- /const.DB.php
|
|
|
|
bakext:
|
|
- ".~"
|
|
- ".bk"
|
|
- ".bak"
|
|
- ".bkp"
|
|
- ".BAK"
|
|
- ".blank"
|
|
- ".swp"
|
|
- ".swo"
|
|
- ".swn"
|
|
- ".tmp"
|
|
- ".save"
|
|
- ".old"
|
|
- ".new"
|
|
- ".orig"
|
|
- ".dist"
|
|
- ".eski" # Turkish word for .bak its common on file backups
|
|
- ".txt"
|
|
- ".disabled"
|
|
- ".original"
|
|
- ".backup"
|
|
- "_bak"
|
|
- "_1.bak"
|
|
- "~"
|
|
- "!"
|
|
- ".0"
|
|
- ".1"
|
|
- ".2"
|
|
- ".3"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "<?php"
|
|
- "<?="
|
|
condition: or
|
|
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "?>"
|
|
- "($"
|
|
- "$_GET["
|
|
- "$_POST["
|
|
- "$_REQUEST["
|
|
- "$_SERVER["
|
|
- "'DB_PASSWORD'"
|
|
- "'DBPASS'"
|
|
- "database_type"
|
|
- "define('DB"
|
|
condition: or
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "text/plain"
|
|
- "bytes"
|
|
condition: or
|
|
# digest: 4a0a0047304502203f2aa5efbaa9a74b1acd13a904876f24d40a7f0de436fe97aa7b737a1083d39a0221009f9a905d1d5ad08f8a531ac0063d0483674c70282bd3a056934f5ab06ff510aa:922c64590222798bb761d5b6d8e72950 |